CN111242290B

CN111242290B - Lightweight privacy protection generation countermeasure network system

Info

Publication number: CN111242290B
Application number: CN202010062453.2A
Authority: CN
Inventors: 杨旸; 穆轲; 郭文忠; 刘西蒙; 程红举; 刘耿耿
Original assignee: Fuzhou University
Current assignee: Fuzhou University
Priority date: 2020-01-20
Filing date: 2020-01-20
Publication date: 2022-05-17
Anticipated expiration: 2040-01-20
Also published as: CN111242290A

Abstract

The invention relates to a lightweight privacy protection generation countermeasure network system, wherein entities comprise a data provider DS, a service provider SP and a first edge serverS ₁And a second edge serverS ₂The software comprises an LP-GAN security computing framework; the LP-GAN security computation framework comprises a security generation model SG and a security discrimination model SD. The invention can ensure the double privacy of the data and the model of the user.

Description

Lightweight privacy protection generation countermeasure network system

Technical Field

The invention relates to the field of machine learning, in particular to a lightweight privacy protection generation countermeasure network system.

Background

Deep learning has achieved important breakthroughs in a variety of computer vision tasks, such as image recognition, image translation, medical image diagnosis and the like. Deep learning algorithms typically require a large number of training samples for improved accuracy of the model. However, due to privacy and legal restrictions, there is not enough training data in many data sensitive areas (e.g., medical, military), and the absence of data makes building a model more difficult.

The generation countermeasure network (GAN) has the ability to learn the distribution of real data (e.g., images, text, video), and can generate generated samples that are difficult to distinguish from real samples, especially over many traditional frameworks in generating composite images, and thus GAN has found wide application in the field of computer vision, while providing a method to alleviate the problem of scarcity of training data. In 2014, Goodfellow et al proposed the concept of GAN, which was trained to generate models through the antagonism process. Then, Radford et al proposed a deep convolutional gan (dcgan) in conjunction with a convolutional neural network that was able to produce high quality false image samples with statistical properties similar to real images. Et al propose a hierarchical recursive GAN (LR-GAN) that uses different generators to generate foreground and background to obtain a clearer image. Denton et al propose Laplacian pyramidGAN (LAPGAN), which uses iteration to generate images from coarse to fine, further improving the quality of GAN synthetic images.

Despite the significant advantages of GAN in generating synthetic images, it still requires significant computational and memory resources to be consumed during the model training phase, and to solve this problem, many users choose to outsource their data and intensive computation to a cloud platform. However, the traditional centralized cloud architecture may cause unpredictable delays in processing and transmitting large amounts of data, which makes this approach unsuitable for time-sensitive applications. Therefore, edge computing is employed to optimize the performance of cloud computing. Edge computing handles computing at the edge of the network near the user's data source, reducing latency and bandwidth consumption between the user and the data center. Security and privacy remain major problems in the task of edge computing to handle GAN, data for outsourcing computations is often unencrypted, and third party edge computing servers are not fully trusted, so many sensitive image data (e.g., facial images, medical images) are at risk of eavesdropping and misuse. Furthermore, the distribution of data samples generated from GAN is similar to training samples, which may lead to implicit privacy leakage. Arjovsky et al can recover the training samples by repeatedly sampling from the model. Therefore, both the training data in the GAN and the privacy of the model need to be protected.

Homomorphic Encryption (HE) is a privacy preserving computing scheme that supports flexible computation of encrypted data. Xie et al propose Cryptonets that implement neural network prediction based on homomorphic encryption. Zhang et al propose a privacy-preserving deep computation model based on homomorphic encryption, which distributes complex computation tasks to a cloud platform for execution. Hesamifard et al propose CryptoDL, which performs training and predictive computations in convolutional neural networks using multiple layers of homomorphic encryption. However, the existing framework based on homomorphic encryption has high time complexity and large storage consumption, and is not suitable for practical application.

Another efficient privacy protection scheme is Differential Privacy (DP), which protects data by adding random noise. In 2017, Abadi et al propose a gradient pruning scheme based on differential privacy, and protect data privacy in the machine learning training process. Shokri et al propose a deep neural network distributed training scheme based on a differential privacy technique. Xie et al propose a differential privacy WGAN model (DPGAN) that achieves differential privacy by adding noise to the gradient during training. Although the performance of the differential privacy technology is better than that of the homomorphic encryption technology, since the algorithm needs to add random noise based on laplacian distribution or gaussian distribution, when the privacy requirement is high, the scheme based on the differential privacy generates more errors, and the method based on the differential privacy needs to make a trade-off between accuracy and privacy.

Disclosure of Invention

In view of this, the present invention provides a lightweight privacy protection generation countermeasure network system, which can ensure the double privacy of the data and model of the user.

The invention is realized by adopting the following scheme: a lightweight privacy protection generation countermeasure network system, the entity includes data provider DS, service provider SP, first edge server S₁And a second edge server S₂The software comprises an LP-GAN security computing framework; the LP-GAN safety calculation framework comprises a safety generation model SG and a safety discrimination model SD;

the data provider DS has training image data and provides initial parameters for the training of the DCGAN neural network; in order to protect the privacy of the image data I and the model parameters P, the DS splits them locally at random into two sets of secret shared data I ', I' and P ', P', which the DS then sends to the first edge server S respectively₁And a second edge server S₂(ii) a Meanwhile, the DS is responsible for generating a random value to meet the requirements of the interactive security protocol;

said first edge server S₁With a second edge server S₂Responsible for executing interactive secure computing protocols; s₁And S₂Secret sharing I ', P ' and I ' are obtained from the data provider,p' is used as input, and the training and generating process with privacy protection is run, and then S₁And S₂Respectively returning the trained privacy protection parameters P ', P' and the generated images O ', O', and sending the parameters to the service provider SP;

service provider SP receives S₁And S₂The generated secret is shared and the plaintext training parameters P of the DCGAN and the generated image O of the plaintext are recovered.

Further, the generative model SG comprises a deconvolution layer, a batch normalization layer, a ReLU layer and a full connection layer; the discrimination model SD comprises a convolution layer, a batch processing normalization layer, a LeakyReLU layer and a full connection layer; each layer includes a secure computing protocol, specifically as follows:

wherein, in the convolutional layer, x is assumed_ijThe method comprises the following steps of (1) performing convolution calculation on elements of an ith row and a jth column of an input matrix X; ω and b are the weight and offset, respectively, of the convolution kernel of size n × n; to protect the privacy of the training data, X is first randomly divided into two random secret shares X 'and X ", where X ═ X' + X", where X is_ijIs divided into two random values x'_ijAnd x ″)_ijMeanwhile, the weights and offsets are divided into two sets of random secret shares (ω'_lm,ω″_lm) And (b ', b'), wherein ω_lm＝ω′_lm+ω″_lmB ═ b' + b "; the secure convolution protocol SecConv is calculated as follows: s₁And S₂And (3) jointly calculating: (a'_lm,a″_lm)←SecMul(ω_lm,x_i+l,j+m)；S₁C 'is calculated'_ij，S₂Calculate c ″_ij：

In the deconvolution layer, the calculation of a secure deconvolution protocol SecDeconv is the same as that of SecConv, and the difference is that a plurality of 0 s need to be filled in an input image of deconvolution calculation to meet the size of an output matrix;

wherein, a safe batch normalization protocol SecBN is adopted in the batch processing normalization layer, and the input is x_i，x_i＝x′_i+x″_iThe batch size is m, and the protocol flow is as follows: s₁And S₂Calculating the batch mean values respectively:

S₁and S₂Collectively calculating the batch variance: (a'_i,a″_i)←SSq(x_i-μ_B)，

S₁And S₂Co-computing normalized values

First, call SISqrt protocol calculation

Where ε is a constant used to ensure numerical stability, with t_i＝x_i-μ_BExpressing standard deviation, calling secure multiplication protocol SecMul to calculate

Assuming that the scaling and offset parameters gamma and beta are publicly known as global parameters, the forward propagation time is a fixed value, the backward propagation time is updated, and S₁And S₂Separately computing normalized outputs

Comprises the following steps:

wherein, in the ReLU layer, SR protocol is adopted, and the flow is as follows: s₁And S₂SR (xi 'is calculated separately'_j) And SR (x ″)_ij)：

Wherein, in the LeakyReLU layer, an SLR protocol is adopted, and the flow is as follows: s₁And S₂Separately calculating SLR (x'_ij) And SLR (x ″)_ij)：

Wherein α ∈ (0,1) is a non-zero constant;

wherein, in the full connection layer, a secure full connection protocol SecFC is adopted, and the input of the full connection layer is set as the output x of the kth layer_k，ω_ikRepresenting the connection weight of the ith neuron of the current layer and the kth neuron of the previous layer, b_iRepresenting the offset of the ith neuron of the current layer, the SecFC protocol flow is as follows: s₁And S₂And (3) jointly calculating: (a'_ik,a″_ik)←SecMul(ω_ik,x_k)，f′_i＝∑_ka′_ik+b_i′，f_i″＝∑_k a″_ik+b_i″。

The superscripts 'and' above represent the two data resulting from the superscript-free data split, respectively.

Further, the running of the training and generating process with privacy protection specifically includes the following steps:

step S1: data provider DS generates model parameters θ for SD and SG_dAnd theta_gAnd respectively splits the preprocessing into two groups of secret sharing data which are respectively sent to the first edge server S₁And a second edge server S₂；

Step S2: training a discrimination model SD: the DS respectively takes m random noise samples z and real image samples x, respectively preprocesses and splits the m random noise samples z and the real image samples x into two groups of data to be shared secretly and sends the two groups of data to the S₁And S₂(ii) a For input noise samples, S₁And S₂Executing a secure generative model forward propagation protocol SG-FP to generate images

For each input data, S₁And S₂Executing the SD-FP and SG-FP, and calculating the loss function of the SD

S₁And S₂Executing a secure back propagation protocol SD-BP to update parameters of the SD;

step S3: training and generating a model SG: the DS takes m random noise samples z for preprocessing, splits the random noise samples into two groups of data, respectively shares the data secretly and sends the data to the S₁And S₂(ii) a For input noise samples, S₁And S₂Generation of images by executing forward propagation protocol SG-FP of generation model

For each generated image, S₁And S₂Executing a secure forward propagation protocol SG-FP for computing a loss function of the SG

S₁And S₂Executing a safe back propagation protocol SG-BP to update parameters of the SG;

step S4: first edge server S₁And a second edge server S₂And respectively returning the secret sharing of the trained model parameters to the service provider SP.

Further, the SD-FP is a forward propagation protocol of the discriminant model, and specifically includes: let the input of the discriminant model be the secret sharing I ', I' of the image, where the first edge server S₁Input I', second edge server S₂Input I', in layer I of the model, the result of the secure convolution calculation protocol SecConv is c^′(i),c^″(i)The calculation result of the secure batch normalization protocol SecBN is y^′(i),y^″(i)The calculation result of the secure LeakyReLU function is slr^′(i),slr^″(i)And finally, the protocol calls a secure full connection protocol SecFC to output the discrimination result f ', f' of the image.

Further onThe SG-FP is a forward propagation protocol of the generative model, and specifically includes: let the input to the generative model be the secret share Z ', Z' of the noisy image, the first edge server S₁Input Z', second edge Server S₂Input Z', in the i layer of the model, the calculation result of the security deconvolution protocol SecDeConv is c^′(i),c^″(i)The calculation result of the secure batch normalization protocol SecBN is y^′(i),y^″(i)The SR calculation result of the secure ReLU protocol is SR^′(i),sr^″(i)The protocol iterates the calculation output generation image f', f ".

Further, the SD-BP is a discriminant model back propagation protocol, which specifically includes:

step S11: the safety loss function propagates backwards: assuming that the parameters of the generated model SG are fixed, calculating and judging the gradient of the model SD loss function by using a random gradient descent algorithm SGD; taking m samples from the real data and the random noise data respectively, wherein the secret sharing of the samples is x^′(i),z^′(i)And x^″(i),z^″(i)Respectively sent to the first edge server S₁And a second edge server S₂I 1.., m; partial derivative of the loss function is represented by

Expressed, SD calculates the partial derivative of the loss function securely by using the secure reciprocal protocol SecInv, as follows:

step S12: the security activation layer propagates in reverse: in the discriminant model SD, let the partial derivative of the security activation function SLR be δ_SLRIndicating that the partial derivative of SLR is calculated using the secure comparison protocol SecCmp, α is a non-zero parameter as follows:

step S13: safe batch normalization layer back propagation: is provided with

Are respectively as

The partial derivative of (a) of (b),

respectively, the intermediate results of the SecBN calculation of the safe batch normalization protocol are set as the symbols of the gradient

The safety gradient of the parameters γ and β is then calculated as follows:

wherein the content of the first and second substances,

since the parameters γ and β are public parameters, after calculating the gradient, S₁Will be provided with

Is sent to S₂At the same time, S₂Will be provided with

Is sent to S₁For restoring the public parameters; assuming a learning rate of η_Bγ and β are updated using the following algorithm:

input parameter x in protocol principal computation normalization_iPartial derivatives of

Is provided with

t_i＝x-μ_BIs an intermediate result of a secure forward calculation, the secure back-propagation protocol utilizes an intermediate variable I_i＝I′_i+I_i1.. m simplifies the inverse calculation process as follows:

(b′_i,b″_i)←SSq(φ′_i,φ″_i)；(c′_i,c″_i)←SecMul(b_i,φ_i)；

then, x is input_iPartial derivatives of

Calculated by the following algorithm:

step S14: safe convolutional layer back propagation: assuming that the learning rate of convolutional layer is η_C，

Representing the partial derivative, S, of the (i, j) th neuron in the network model₁And S₂Calculating gradients of weights ω and bias values b in cooperation with executing the following protocol

And update the original parameters:

further, the SG-BP is a back propagation protocol of the generative model, and since a part of the protocol is substantially the same as the SD-BP, only two different secure back propagation calculations in the generative model are given here, specifically:

step S21: the safety loss function propagates backwards: in SG-BP, the back propagation protocol of the security loss function is as follows:

step S22: the security activation layer is propagated reversely: let delta_SRThe partial derivative of the safe ReLU algorithm SR is represented, and the safe partial derivative calculation algorithm of SR is as follows:

compared with the prior art, the invention has the following beneficial effects:

1. the invention adopts edge calculation, designs a series of protocols based on secret sharing, and is used for protecting the privacy of data and key model parameters in the DCGAN model training and image generation processes.

2. Aiming at the problems of low computation efficiency and high communication overhead of privacy protection machine learning, the invention provides a privacy protection basic computation protocol with higher efficiency and lower communication overhead. Meanwhile, based on the secret sharing design, the error problem caused by a difference privacy scheme is completely avoided, high-precision calculation is provided, and the error transmission problem in a deep network model is relieved.

3. Aiming at a complex DCGAN structure, the invention provides a security generation model (SG) and a security authentication model (SD), and constructs a security forward propagation protocol for safely judging the authenticity of an image and generating the image; a safe back propagation protocol is designed for safely training and updating model parameters, and the data of a user and the double privacy of the model can be ensured in the whole process.

Drawings

Fig. 1 is a schematic diagram of a system architecture according to an embodiment of the present invention.

Fig. 2 shows a DCGAN structure according to an embodiment of the present invention.

FIG. 3 is a software framework diagram of an embodiment of the present invention

Fig. 4 is a security discriminant model and a security generation model architecture according to an embodiment of the present invention.

FIG. 5 is a schematic diagram of a security comparison protocol calculation logic according to an embodiment of the present invention.

Detailed Description

The invention is further explained below with reference to the drawings and the embodiments.

It should be noted that the following detailed description is exemplary and is intended to provide further explanation of the disclosure. Unless defined otherwise, all technical and scientific terms used herein have the same meaning as commonly understood by one of ordinary skill in the art to which this application belongs.

It is noted that the terminology used herein is for the purpose of describing particular embodiments only and is not intended to be limiting of example embodiments according to the present application. As used herein, the singular forms "a", "an" and "the" are intended to include the plural forms as well, and it should be understood that when the terms "comprises" and/or "comprising" are used in this specification, they specify the presence of stated features, steps, operations, devices, components, and/or combinations thereof, unless the context clearly indicates otherwise.

As shown in fig. 1 and fig. 3, the present embodiment provides a lightweight privacy protection generation countermeasure network system, and the entities include a data provider DS, a service provider SP, and a first edge server S₁And a second edge server S₂The software comprises a DCGAN neural network; the DCGAN neural network comprises a generation model SG and a discrimination model SD;

the data provider DS possesses training image data (possibly containing sensitive information) and provides initial parameters for training of the DCGAN neural network; in order to protect the privacy of the image data I and the model parameters P, the DS splits them locally at random into two sets of secret shared data I ', I' and P ', P', which the DS then sends to the first edge server S respectively₁And a secondEdge server S₂(ii) a Meanwhile, the DS is responsible for generating random values to meet the requirements of the interactive security protocol, and the random values can be generated off-line and then used in an on-line computing stage;

the first edge server S₁With a second edge server S₂Responsible for executing interactive secure computing protocols; s₁And S₂Obtaining secret shares I ', P' and I ', P' from a data provider, respectively, as input, and running a training, generation process with privacy protection, followed by S₁And S₂Respectively returning the trained privacy protection parameters P ', P' and the generated images O ', O', and sending the parameters to the service provider SP;

The method provided by the invention is used for preventing malicious adversaries

Capable of attacking one server S₁(cannot successfully attack both servers at the same time),

the original plaintext data still cannot be recovered because of S₁The held data are meaningless random secret shares. After the training process is complete, the Service Provider (SP) can go from S₁And S₂Secret sharing of the trained model parameters and the synthesized image is obtained, and the original data is restored by using addition. As shown in FIG. 3, the software system of the present invention consists of two models: a security discriminant model (SD) and a security Generator model (SG). SD is used to predict whether the input data is authentic or generated by providing an authentic image or a generated image. Random noise is input, and SG can generate an image. To generate near-true images, the LP-GAN constructs the SD and SG using the structure of DCGAN. As shown in fig. 4: for training SD and SG, the present embodiment proposes a secure forward propagation algorithm (SD-FP protocol 8, SG-FP protocol 9) and AnnThe full back propagation algorithm (SD-BP, SG-BP) is used for protecting data and model privacy in forward and back propagation calculation.

In the present embodiment, as shown in fig. 2 and 4, the generative model SG includes an deconvolution layer, a batch normalization layer, a ReLU layer, and a full connection layer; the discrimination model SD comprises a convolution layer, a batch processing normalization layer, a LeakyReLU layer and a full connection layer;

wherein, convolution layer and deconvolution layer: in convolutional neural networks, convolution operations are typically used to extract features from input data. Suppose the input data (matrix) is

The size of the convolution kernel is n × n. Neurons having the same weight w_lm(l, m ═ 0, 1.., n-1) and a bias value b, the convolution output of the (i, j) th neuron in the model is

The computation of deconvolution is similar to convolution, except that the size of the input matrix X needs to satisfy the requirements of the output matrix by filling in multiple 0 values. Batch normalization layer: the batch normalization operation normalizes the input data by adjustment and scaling, and stabilizes the activation value distribution of the neurons into normal distribution. Assume that the input data is { x }_i}_i∈[1,m]The batch size is m, and batch normalization can be calculated through the following steps. First, an average value of inputs is calculated

Sum variance

Then, input data is normalized to

Where ε is a minimum amount to prevent the denominator from being 0. Finally, calculate

Where γ and β are the scaling and shifting parameters. An active layer: the activation function introduces a non-linear element into the neural network. In generative model G, neurons use the ReLU function (f (x) ═ max (0, x)) as an activation function. In the discriminant model D, leak relu (f (x) ═ max (x, α x), α ∈ (0,1)) is used as an activation function. Full connection layer: the neurons in the fully connected layer connect all neurons in the previous layer for merging features extracted from upper layer neurons. Let x be_kInput data for the kth neuron in the upper layer, ω_ikRepresenting the weight connecting the kth neuron of the upper layer and the ith neuron of the current layer, b_iRepresenting the bias value of the ith neuron in the current layer. The output of the ith neuron in the fully connected layer is

Preferably, the embodiment also provides a protocol based on secret sharing and a secure basic computing protocol. The method comprises the following specific steps:

the protocol based on secret sharing adopts a secret sharing scheme to execute security basic calculation, the system model of the embodiment is based on two-party calculation (2PC), and the protocol is formed by two servers S₁And S₂And the two random numbers are operated together, and a plurality of groups of random numbers are required to be generated in advance for protocol calculation. The symbols A 'and A' indicate the allocation to two servers S₁And S₂Is shared (where a ═ a' + a ").

And (4) a safe addition protocol: given an input

Secure addition protocol SecAdd at S₁Output f₁At S₂Output f₂Wherein f is₁+f₂U + v. In this process, the two servers perform computations only locally, without interaction.

Safe multiplication protocol: the secure multiplication protocol SecMul is based on the Beaver's triplet scheme. Given an input

SecMul at S₁Output f₁At S₂Output f₂And f is and₁+f₂u · v. In this process, three random numbers (a, b, c) will be generated to ensure that no information leaks during the calculation.

Safe natural logarithm protocol: the secure natural logarithm protocol SecLog is based on the mclaurin formula, iteratively approximating the natural logarithm f (u) ═ ln (u). Given an input

SecLog at S₁Output f₁At S₂Output f₂When iteration reaches the predefined precision, the calculation result satisfies f₁+f₂≈ln(u)。

Safety reciprocal protocol: the secure reciprocal protocol SecInv is based on the newton-laplace calculation scheme. Given an input

SecInv outputs an approximate result of f (u) of 1/u. When a predefined accuracy is reached, SecInv terminates the iterative process and at S₁Output f₁At S₂Output f₂Wherein f is₁+f₂≈1/u。

The protocol based on secret sharing is only suitable for an integer range, but the real number calculation involved in the machine learning process cannot be directly processed by adopting the secret sharing protocol, so that the real number is firstly converted into an integer form in the calculation of the invention, and then the security protocol is executed. Real number

Can be expressed in the form of fixed point number

Wherein

Is a part of the integer, and is,

is the fractional part. In the invention, only the integer part x participates in protocol calculation, and simultaneously epsilon is fixed to be a proper value so as to meet the precision requirement, and higher precision management can be realized by selecting larger epsilon.

Secure XOR (Secure XOR, SecXor) for calculating the result of the XOR operation on bit data. Input device

(u＝u₁+u₂，v＝v₁+v₂) In which S is₁Input u₁,v₁，S₂Input u₂,v₂. After executing SecXor protocol, S₁Output of

S₂Output of

And guarantee

In the protocol, S_i(i ∈ (1,2)) calculating f respectively_i＝(u_i+v_i) mod2, derived as:

security or protocol (secuor, SecOr) for computing bit or result. Input device

(u＝u₁+u₂，v＝v₁+v₂) After executing SecOr protocol (e.g., protocol 1), S₁Output of

S₂Output of

And is

Wherein S₁And S₂The-u.v is jointly calculated using the secure multiplication protocol SecMul.

The Secure Most Significant Bit protocol (SecMSB) is a sub-protocol of the Secure compare protocol. Inputting binary bit sequence u_l-1,...,u₀]SecMSB protocol (e.g. protocol 2) outputs a sequence f_l-1,...,f₀]For locating the position of the highest bit number "1" in the input sequence. Let j denote the highest order u_jIf 1, then f in the output_jThe remaining bits all have a value of 0. In addition, SecMSB additionally outputs a bit ζ if [ u ] is input_l-1,...,u₀]All the bits in the data are 0, ζ is 0, otherwise ζ is 1.

The algorithm flow for SecMSB is as follows: first the data provider DS generates two random numbers t'_lAnd t ″)_l(satisfy t'_l+t″_l1) and sends the random number to the edge server S₁And S₂(ii) a Then, S₁And S₂Executing secure multiplication protocol SecMul to calculate a sequence t'_l,...,t′₀]，[t″_l,...,t″₀](t_i＝t′_i+t″_i) This sequence locates the input u_l-1,...,u₀]Bit position j with the highest bit of 1, where [ t ]_l,...,t_j+1]＝[1,....,1]And [ t)_j,...,t₀]＝[0,....,0](ii) a Then S₁And S₂Respectively calculate f_i′＝t′_i+1-t′_i，f_i″＝t″_i+1-t″_iSequence [ f ]_l-1,...,f₀]Except that f is 1 at the j position of the highest position_jAll the remaining bits are 0. To determine if the input sequence is all 0S₁And S₂A flag bit ζ is additionally calculated,

and is

When the inputs are all 0, ζ is 0, otherwise, ζ is 1.

For example, if [ u ] is input_l-1,...,u₀]＝[00011010]SecMSB calculated j 4, [ t [ [ t ]_l,...,t₀]＝[11100000]And output [ f_l-1,...,f₀]＝[00000000]And ζ ═ 1. If input [ u ]_l-1,...,u₀]＝[00000000]SecMSB calculation of [ t [ ]_l,...,t₀]＝[11111111]And output [ f_l-1,...,f₀]＝[00000000]And ζ ═ 0.

Secure compare protocol (SecCmp) compares two inputs

If u > v, the SecCmp protocol (e.g., protocol 3) outputs 1, and if u ≦ v, the protocol outputs 0. Due to S₁And S₂Respectively input u₁,v₁And u₂,v₂For convenience of comparison, the problem is here converted into a comparison of a to u₁-v₁And b ═ u₂-v₂It can be deduced that if a > b, then u > v, otherwise u ≦ v.

Because the SecCmp protocol adopts a bit-based comparison method, the protocol firstly uses a bit decomposition method DFC (data format conversion), and the method converts an integer into a whole number

Binary bit sequence format [ u ] decomposed into length of length l_l-1,...,u₀]. Converting | u | ═ 0,2^l-1-1]Decomposition into a bit sequence u_l-2,...,u₀]Highest bit u_l-1Representing a sign bit, if u < 0, u _l-11, otherwise, u _l-10. Definition of

Is an unsigned integer value of u.

The SecCmp protocol flow is as follows:

(1) the protocol first calculates a ═ u₁-v₁And b ═ u₂-v₂Is represented by a binary bit sequence. The protocol then compares the two unsigned integers

And

(2) to implement the comparison calculation, S₁And S₂First, the SecXor protocol is called to calculate [ a_l-1,...,a₀]And [ b)_l-1,...,b₀]In different bit, output

(3) To position [ c)_l-1,...,c₀]Bit position with the highest median order 1, S₁And S₂Running SecMSB protocol across compute sequence [ d'_l-1,...,d′₀]Sum orderColumn [ d_l-1,...,d″₀](d_i＝d′_i+d′_i). If a^*≠b^*，[d_l-1,...,d₀]Has only one bit d_jJ represents the identity of the first different bit of two numbers from high to low; if a^*＝b^*，[d_l-1,...,d₀]All bits in (a) are 0.

(4)S₁And S₂Performing secure multiplication protocol SecMul computation e_i＝a_i·d_iAnd separately calculate

For comparison of a^*And b^*If a^*＞b^*And xi is 1, otherwise xi is 0. SecMSB additional calculation identifier ζ for determining a^*Whether or not to be equal to b^*If a^*＝b^*And if not, the zeta is 1.

(5) Then, S₁And S₂Executing SecOr protocol to calculate iota ═ a_l-1∨b_l-1And the judgment is used for judging the positive and negative of a and b, if a is more than or equal to 0, and b is more than or equal to 0, the iota is 0, otherwise, the iota is 1.

(6) When a ≠ b, S₁And S₂Computing

The results of (a) can be compared in magnitude.

(7) When a is b < 0, ν is not as expected, and the edge server needs to further calculate f is ν ζ to obtain the correct comparison result.

The computational logic of the SecCmp protocol is shown in fig. 5. Assume the input of SecCmp is u₁＝-1030，u₂＝583，v₁＝-929，v₂551 (in which u is u₁+u₂＝-447，v＝v₁+v₂378), a can be obtained₁-v₁＝-101，b＝v₂-u₂-32; according to the DFC protocol, the signed binary representation of a, b is [ a ], respectively_l-1,...,a₀]＝[11100101]，[b_l-1,...,b₀]＝[10100000](ii) a Since a < 0, b < 0, and a^*＞b^*It can be deduced that iota ═ 1, ξ ═ 1,

the algorithm introduces the variable ζ segment a ≠ b, which is derived from above, and therefore ζ ≠ 1. The final result is calculated as f ═ ν · ζ ═ 0 · 1 ═ 0, and the result indicates a ≦ b, i.e., u ≦ v, which is the same as the plaintext data comparison result.

Secure Square Root Protocol (SSqrt) for computing

The protocol is based on a fast square root computation method, the Goldschmidt algorithm, which converges faster and can achieve higher accuracy in the same time as the Newton-Simpson algorithm. The flow of the Goldschmidt algorithm is as follows:

(1) an initialization stage: the algorithm initializes two iteration parameters g and h, g represents

The approximate iteration value of (1), h represents

Of g, where g₀＝uy₀，h₀＝1/2y₀，y₀Is that

Initial approximation of, y₀A linear formula y may be used₀An approximation is calculated for α u + β, where α -0.8099868542 and β -1.787727479 are constants.

(2) An iterative computation stage: the algorithm calculates the square root according to the following iterative formula:

the Secure Range Conversion protocol (SRC) is a sub-protocol of the Secure square root protocol for converting integers into the form of bases and exponents and bases into a specific Range. To compute the square root quickly, the input data needs to be converted into the interval [1/2, 1). Suppose 2^p-1≤u＜2^pThe SRC protocol (protocol 4) converts u to the interval 1/2 ≦ u · 2^-pLess than 1; input device

S₁And S₂The cooperative computing converts it into u₁＝m₁·2^p，u₂＝m₂·2^p. The SRC protocol flows are as follows:

(1)S₁and S₂Respectively locally calculating

And a is to_iRandom division into two random secret shares a_i' and a_iAnd guarantee a_i∈[1/4,1/2)(i∈{1,2})。

(2)S₁And a ″)₁And p₁Is sent to S₂，S₂A'₂And p₂Is sent to S₁。

(3)S₁And S₂Respectively take p₁,p₂Medium and large values, and separately calculate

And

it can be deduced that u ═ m₁·2^p+m₂·2^p＝m·2^p。

Compared with the existing scheme, the safety Square Root protocol (SSqrt) improves the convergence rate on the premise of the same safety, and can obtain higher calculation accuracy under the condition of the same time consumption. The protocol is divided into three stages, an initialization stage, an iteration stage and a result conversion stage. The flow of the SSqrt protocol (protocol 5) is as follows:

(1) an initialization stage: s₁And S₂Interactively generating an initial parameter g₀And h₀. First of all S₁And S₂Performing the SRC protocol to calculate m₁,m₂P, guarantee u₁＝m₁·2^p，u₂＝m₂·2^p(ii) a Then, S₁And S₂Respectively calculate y'₀ ′←αm₁+β，h′₀←1/2(αm₁+β)，y″₀←αm₂，h″₀←1/2(αm₂) Initialization parameter y₀And g₀(ii) a Finally, S₁And S₂Computing g by calling SecMul protocol₀←my₀。

(2) An iteration stage: given u-m.2_pIn this stage, S₁And S₂Interactively iterative computation

And

when the iteration parameter i < tau, S₁And S₂Collectively 3/2-g_ih_i(ii) a In line 10, the edge server performs SecMul protocol computation iteration result g_i+1＝g_i(3/2-g_ih_i) And h_i+1＝h_i(3/2-g_ih_i) Wherein g is_i+1And h_i+1The computations of (a) may be performed in parallel; after the iteration is finished, the value g is output_iIs composed of

Approximation of h_iIs composed of

An approximation of (d).

(3) And a result conversion stage: the goal of the protocol is to compute

And

the calculated relationship of (a) is as follows:

if p is an even number, setting a to 1; if p is odd, set up

And calculate

Can finally calculate

Secure reciprocal square root protocol: since the batch normalization operation in the GAN framework requires calculation

The invention designs a Secure Inverse Square Root protocol (SISqrt). In the SSqrt protocol (protocol 5), h_iIterative computation

The SISqrt protocol is based on an SSqrt construction, only the 14 th to 15 th rows in protocol 5 need to be replaced by

And

by derivation:

secure Square Protocol (SSq): input device

SSq (protocol 6) calculates f (u) u². SSq the calculation flow is as follows:

(1) input device

S₁And S₂Calling SecMul protocol to calculate 2u₁v₁。

(2)S_iComputing

Each layer includes a secure computing protocol, specifically as follows:

wherein, in the convolutional layer, x is assumed_ijThe method comprises the following steps of (1) performing convolution calculation on elements of an ith row and a jth column of an input matrix X; ω and b are the weight and offset, respectively, of the convolution kernel of size n × n; to protect the privacy of the training data, X is first randomly divided into two random secret shares X 'and X ", where X ═ X' + X", where X is_ijIs divided into two random values x'_ijAnd x ″)_ijWhile shifting the weights and offsetsQuantity is divided into two groups of random secret sharing (omega'_lm,ω″_lm) And (b ', b'), wherein ω is_lm＝ω′_lm+ω″_lmB ═ b' + b "; the secure convolution protocol SecConv is calculated as follows: s₁And S₂And (3) jointly calculating: (a'_lm,a″_lm)←SecMul(ω_lm,x_i+l,j+m)；S₁C 'is calculated'_ij，S₂Calculate c ″_ij：

S₁And S₂Co-computing normalized values

First, call SISqrt protocol calculation

Comprises the following steps:

in the ReLU layer, SR protocol is adopted, and the activation layer provides non-linear calculation for the neural network. Let the input be x, S₁And S₂The security comparison protocol SecCmp is executed jointly to determine whether x is greater than 0, and if SecCmp (x,0) is 1, i.e., x > 0, sr (x) is x, otherwise sr (x) is 0. For the (i, j) th neuron, the SR procedure is as follows: s₁And S₂SR (x 'is calculated separately'_ij) And SR (x ″)_ij)：

The drawback of the ReLU function is that the function can only learn the gradient when x is greater than 0, in order to solve the problem, LeakyReLU introduces a non-zero constant α ∈ (0,1) when calculating the case that x is less than or equal to 0, and for the (i, j) th neuron, an SLR protocol is adopted, and the flow is as follows: s₁And S₂Separately calculating SLR (x'_ij) And SLR (x ″)_ij)：

Wherein α ∈ (0,1) is a non-zero constant;

wherein, in the fully-connected layer, the nerves in the fully-connected layerThe element is connected with all the neurons of the upper layer, a safe full connection protocol SecFC is adopted, and the input of the full connection layer is set as the output x of the kth layer_k，ω_ikRepresenting the connection weight of the ith neuron of the current layer and the kth neuron of the previous layer, b_iRepresenting the offset of the ith neuron of the current layer, the SecFC protocol flow is as follows: s₁And S₂And (3) jointly calculating: (a'_ik,a″_ik)←SecMul(ω_ik,x_k)，f′_i＝∑_k a′_ik+b_i′，f_i″＝∑_k a″_ik+b_i″。

In this embodiment, the running of the training and generating process with privacy protection specifically includes the following steps:

step S3: training and generating a model SG: the DS takes m random noise samples z as pretreatment and splits the samples into two groups of numbersRespectively secretly sharing and sending to S₁And S₂(ii) a For input noise samples, S₁And S₂Generation of images by executing forward propagation protocol SG-FP of generation model

Wherein, the specific algorithm of the training step is as protocol 7, and the parameter of the discriminant model is set as theta_dThe parameter of the generative model is theta_g(ii) a The random noise sample is z, the real image sample is x, and the generated image is

The learning rate of the safety discrimination model SD is eta_dThe learning rate of the safety generative model SG is eta_gThe batch size is M, the total amount of training samples is M, and the number of model training rounds is N_dAnd N_gThe forward propagation protocol and the backward propagation protocol of the safety discrimination model SD are respectively SD-FP and SD-BP, and the forward propagation protocol and the backward propagation protocol of the safety generation model SG are respectively SG-FP and SG-BP.

The present embodiment proposes two secure forward propagation protocols: the system comprises a security discrimination model Forward Propagation protocol (SD-FP) and a security generation model Forward Propagation protocol (SG-FP) which are used for completing the security calculation of model Forward Propagation. Meanwhile, the invention designs a secure computation protocol for different layers in the model respectively, including a convolution layer, an activation layer, a batch normalization layer, a full connection layer and the like (as described above). In the protocol, the hyper-parameters and constants are in a plaintext form, and other data are shared by random secrets and are used for protecting the privacy of training images and models.

In this embodiment, the SD-FP is a forward propagation protocol of the discriminant model, which specifically includes: let the input of the discriminant model be the secret sharing I ', I' of the image, where the first edge server S₁Input I', second edge server S₂Input I', in layer I of the model, the result of the secure convolution calculation protocol SecConv is c^′(i),c^″(i)The calculation result of the secure batch normalization protocol SecBN is y^′(i),y^″(i)The calculation result of the secure LeakyReLU function is slr^′(i),slr^″(i)And finally, the protocol calls a secure full connection protocol SecFC to output the discrimination result f ', f' of the image. As shown in protocol 8.

In this embodiment, the SG-FP is a forward propagation protocol of a generative model, which specifically includes: let the input to the generative model be the secret share Z ', Z' of the noisy image, the first edge server S₁Input Z', second edge Server S₂Input Z', in the i layer of the model, the calculation result of the security deconvolution protocol SecDeConv is c^′(i),c^″(i)The calculation result of the secure batch normalization protocol SecBN is y^′(i),y^″(i)The SR calculation result of the secure ReLU protocol is SR^′(i),sr^″(i)The protocol iterates the calculation output generation image f', f ". As shown in protocol 9.

In this embodiment, the SD-BP is a discriminant model back propagation protocol, which specifically includes:

step S11: the safety loss function propagates backwards: assuming that the parameters of the generated model SG are fixed, calculating and judging the gradient of the model SD loss function by using a random gradient descent algorithm SGD; taking m samples from the real data and the random noise data respectively, wherein the secret sharing of the samples is x^′(i),z^′(i)And x^″(i),z^″(i)Respectively sent to the first edge server S₁And a second edge server S₂I 1.., m; partial derivative of the loss function is given by

step S13: safe batch normalization layer back propagation: is provided with

Are respectively as

The partial derivative of (a) of (b),

The safety gradient of the parameters γ and β is then calculated as follows:

wherein, the first and the second end of the pipe are connected with each other,

since the parameters γ and β are public parameters, after the gradient is calculated, S₁Will be provided with

Is sent to S₂At the same time, S₂Will be provided with

Is provided with

t_i＝x-μ_BIs an intermediate result of a secure forward calculation, the secure back-propagation protocol utilizes an intermediate variable I_i＝I′_i+I″_i1.. m simplifies the inverse calculation process as follows:

(b′_i,b″_i)←SSq(φ′_i,φ″_i)；(c′_i,c″_i)←SecMul(b_i,φ_i)；

then, x is input_iPartial derivatives of

Calculated by the following algorithm:

And update the original parameters:

in this embodiment, the SG-BP is a back propagation protocol of a generative model, and since a part of the protocol is substantially the same as the SD-BP, only two different secure back propagation calculations in the generative model are given here, specifically:

step S22: secure active layer reversalPropagation: let delta_SRThe partial derivative of the safety ReLU algorithm SR is expressed, and the calculation algorithm of the safety partial derivative of SR is as follows:

in summary, the embodiment supports the interactive execution of the secure computing protocol by the edge server, and a completely trusted third-party entity is not needed, the system is guaranteed to complete the machine learning computation safely without revealing training data and model parameters, and a user does not need to interact with the server during the protocol execution. Secondly, the framework provides a high-efficiency, low-communication-consumption and high-precision basic computing protocol, reduces the execution time and data transmission quantity of complex GAN model training and prediction computation, relieves the error transmission problem, and improves the practicability of the system while protecting the data privacy. Thirdly, the framework supports the functions of security image generation, security image authenticity prediction and the like of the GAN network. Fourthly, the framework provides a security training scheme of the GAN model, and model parameters can be updated under privacy protection by the edge server. Finally, the training data set and the model parameters for machine learning are kept secret from the edge server, so that better privacy protection is realized.

The foregoing is directed to preferred embodiments of the present invention, other and further embodiments of the invention may be devised without departing from the basic scope thereof, and the scope thereof is determined by the claims that follow. However, any simple modification, equivalent change and modification of the above embodiments according to the technical essence of the present invention are within the protection scope of the technical solution of the present invention.

Claims

1. A lightweight privacy protection generation countermeasure network system is characterized in that entities comprise a data provider DS, a service provider SP and a first edge server S₁And a second edge server S₂The software comprises an LP-GAN security computing framework; the LP-GAN is safeThe computing framework comprises a safety generation model SG and a safety discrimination model SD;

the data provider DS has training image data and provides initial parameters for training the DCGAN neural network; in order to protect the privacy of the image data I and the model parameters P, the DS splits them locally at random into two sets of secret shared data I ', I' and P ', P', which the DS then sends to the first edge server S respectively₁And a second edge server S₂(ii) a Meanwhile, the DS is responsible for generating a random value to meet the requirements of the interactive security protocol;

the first edge server S₁With a second edge server S₂Responsible for executing interactive secure computing protocols; s₁And S₂Secret shared data I ', P' and I ', P' are obtained as input from a data provider, respectively, and a training, generation protocol with privacy protection is run, after S₁And S₂Respectively returning the trained privacy protection parameters P ', P' and the generated images O ', O', and sending the parameters to the service provider SP;

2. The lightweight privacy protection generation countermeasure network system of claim 1, wherein the secure generation model SG includes an deconvolution layer, a batch normalization layer, a ReLU layer, and a full connection layer; the safety discrimination model SD comprises a convolution layer, a batch processing normalization layer, a LeakyReLU layer and a full connection layer; each layer includes a secure computing protocol, specifically as follows:

wherein, in the convolutional layer, x is assumed_ijThe method comprises the following steps of (1) performing convolution calculation on elements of an ith row and a jth column of an input matrix X; ω and b are the weight and offset, respectively, of the convolution kernel of size n × n; to protect the privacy of the training data, X is first randomly divided into two random secret shares X 'and X ", where X ═ X' + X", where X is_ijIs divided into two random values x'_ijAnd x ″)_ijWhile dividing the weight and the offset into twoGroup random secret sharing (ω'_lm,ω″_lm) And (b ', b'), wherein ω_lm＝ω′_lm+ω″_lmB ═ b' + b "; the secure convolution protocol SecConv is calculated as follows: s₁And S₂And (3) jointly calculating: (a'_lm,a″_lm)←SecMul(ω_lm,x_i+l,j+m)；S₁C 'is calculated'_ij，S₂Calculate c ″)_ij：

wherein, a safe batch normalization protocol SecBN is adopted in the batch processing normalization layer, and the input is x_i，x_i＝x′_i+x″_iThe batch size is m, and the protocol flow is as follows: s. the₁And S₂Calculating the batch mean values respectively:

S₁And S₂Co-computing normalized values

First, call SISqrt protocol computation

Where ε is a constant, used to ensure numerical stability, with t_i＝x_i-μ_BExpressing standard deviation, calling secure multiplication protocol SecMul to calculate

Comprises the following steps:

wherein, in the ReLU layer, SR protocol is adopted, and the flow is as follows: s. the₁And S₂SR (x 'is calculated separately'_ij) And SR (x ″)_ij)：

Wherein α ∈ (0,1) is a non-zero constant;

wherein, in the full connection layer, a secure full connection protocol SecFC is adopted, and the input of the full connection layer is set as the output x of the kth layer_k，ω_ikRepresenting the connection weight of the ith neuron of the current layer and the kth neuron of the previous layer, b_iRepresenting the offset of the ith neuron of the current layer, the SecFC protocol flow is as follows: s₁And S₂And (3) jointly calculating: (a'_ik,a″_ik)←SecMul(ω_ik,x_k)，f_i′＝∑_ka′_ik+b_i′，f_i″＝∑_ka″_ik+b_i″。

3. The system of claim 2, wherein the running of the training and generation process with privacy protection specifically comprises the following steps:

step S3: training and generating a model SG: the DS takes m random noise samples z for preprocessing, splits the random noise samples into two groups of data, respectively shares the data secretly and sends the data to the S₁And S₂(ii) a For input noise samples, S₁And S₂Executing forward propagation protocol SG-FP generation of generation modelImaging

4. The system of claim 3, wherein the SD-FP is a forward propagation protocol of a discriminant model, and specifically comprises: let the input of the discriminant model be the secret sharing I ', I' of the image, where the first edge server S₁Input I', second edge server S₂Input I', in layer I of the model, the result of the secure convolution calculation protocol SecConv is c^′(i),c″⁽ⁱ⁾Y 'is the calculation result of SecBN'⁽ⁱ⁾,y″⁽ⁱ⁾The calculation result of the secure LeakyReLU function is slr'⁽ⁱ⁾,slr″⁽ⁱ⁾And finally, the protocol calls a secure full connection protocol SecFC to output the discrimination result f ', f' of the image.

5. The lightweight privacy protection generation countermeasure network system of claim 3, wherein the SG-FP is a forward propagation protocol of a generation model, specifically: let the input to the generative model be the secret share Z ', Z' of the noisy image, the first edge server S₁Input Z', second edge Server S₂Input Z ', in the ith layer of the model, the calculation result of the secure deconvolution protocol SecDeConv is c'⁽ⁱ⁾,c″⁽ⁱ⁾The secure batch normalization protocol SecBN calculation result is y'⁽ⁱ⁾,y″⁽ⁱ⁾The calculation result of the SR of the safe ReLU protocol is SR'⁽ⁱ⁾,sr″⁽ⁱ⁾The protocol iterates the calculation output generation image f', f ".

6. The lightweight privacy protection generation countermeasure network system of claim 3, wherein the SD-BP is a discriminant model back propagation protocol, specifically:

step S11: the safety loss function propagates backwards: assuming that the parameters of the generated model SG are fixed, calculating and judging the gradient of the model SD loss function by using a random gradient descent algorithm SGD; taking m samples from the real data and the random noise data respectively, wherein the secret sharing x 'of the samples'⁽ⁱ⁾,z′⁽ⁱ⁾And x ″)⁽ⁱ⁾,z″⁽ⁱ⁾Respectively sent to the first edge server S₁And a second edge server S₂I 1.., m; partial derivative of the loss function is represented by

step S12: the security activation layer is propagated reversely: in the discriminant model SD, let the partial derivative of the security activation function SLR be δ_SLRIndicating that the partial derivative of SLR is calculated using the secure comparison protocol SecCmp, α is a non-zero parameter as follows:

step S13: safe batch normalization layer back propagation: is provided with

Are respectively x_i,y_i,

Partial derivative of (a), x_i,y_i,

Respectively, for the intermediate results of the secure batch normalization protocol SecBN calculation, assuming the sign of the gradient as ^ then the secure gradients for the parameters γ and β are calculated as follows:

wherein the content of the first and second substances,

since the parameters γ and β are public parameters, after the gradient is calculated, S₁Sending ^ gamma ', (beta') to S₂At the same time, S₂Sending ^ gamma ^ and ^ beta "to S₁For restoring the public parameters; assuming a learning rate of η_Bγ and β are updated using the following algorithm: gamma ray_new＝γ-η_B·▽γ，β_new＝β-η_BBeta; input parameter x in protocol principal computation normalization_iPartial derivatives of

Is provided with

t_i＝x-μ_BIs an intermediate result of a secure forward calculation, the secure back-propagation protocol utilizes an intermediate variable I_i＝I_i′+I_i1.. m simplifies the inverse calculation process as follows:

(b_i′,b″_i)←SSq(φ′_i,φ″_i)；(c′_i,c″_i)←SecMul(b_i,φ_i)；

then, x is input_iPartial derivatives of

Calculated by the following algorithm:

Representing the partial derivative, S, of the (i, j) th neuron in the network model₁And S₂Calculate a gradient ∑ ω ++ v ++ of a weight ω and a bias value b ++ and update the original parameter in cooperation with the following protocol:

ω′_lm(new)＝ω′_lm-η_C·▽ω′_lm；ω″_lm(new)＝ω″_lm-η_C·▽ω″_lm；b′_(new)＝b′-η_C·▽b′；b″_(new)＝b″-η_C·▽b″。

7. the system according to claim 3, wherein the SG-BP is a back propagation protocol of a generative model, and since a part of the protocol is substantially the same as the SD-BP, only two different secure back propagation calculations in the generative model are given here, specifically:

step S22: the security activation layer propagates in reverse: let delta_SRThe partial derivative of the safety ReLU algorithm SR is expressed, and the calculation algorithm of the safety partial derivative of SR is as follows: